Security update

#1119192 by Andrew Schulman: fix Role Delegation tab in user profile appears as an action, not a tab.
#1180600 by jyee: fix overwrites role attributes in forms.
#1185796 by Andrew Schulman: fix Role delegation options appear in every profile edit form with Profile 2.
#1193868 by Andrew Schulman: fix Unsanitized output in role_delegation_delegate_roles_action_form().

Security update of the distribution prompted by the CKEditor security update. Check COMMONS_RELEASE_NOTES.txt for the full release notes for the distribution. See acquia.com later today for a Drupal Commons 1.7 download.

Summary:

• fixes an XSS vulnerability where the revision "unpublish" form printed unescaped node titles (#1093722)
• fixes a case where the mini-moderation form could moderate an unreviewed revision (#1127722)
• Workbench is now required to display moderation status messages and the mini-moderation form when viewing a node or revision.
• Pathauto persistant state is recommended if you are using Pathauto with moderated content (per #1087044)
• miscellaneous bugfixes

Security release, see http://drupal.org/node/1183116

Also a number of bug fixes.

Fixes multiple vulnerabilities described in

SA-CONTRIB-2011-023

http://drupal.org/node/1182968

Security fix for SA-CONTRIB-2011-020 - tac_lite - Cross Site Scripting

Creating a release for the changes that were supposed to go into release 1.5, because I can't get git to ever do what I want. Can't wait to find out whether this worked!